CVE-2025-8152 Overview
CVE-2025-8152 affects the WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress. The vulnerability exists in all versions up to and including 1.7.0. It stems from missing capability checks on the update_cta_status and change_sticky_sidebar_name functions. Unauthenticated attackers can update sticky call-to-action status values and modify the name displayed in the back-end WP CTA Dashboard. The issue is classified as Missing Authorization [CWE-862] and is reachable over the network without authentication or user interaction.
Critical Impact
Unauthenticated remote attackers can modify plugin configuration data, including sticky CTA status and sidebar naming, on any affected WordPress site running the vulnerable plugin.
Affected Products
- WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons (WordPress plugin, slug: easy-sticky-sidebar)
- All versions up to and including 1.7.0
- WordPress installations with the plugin activated
Discovery Timeline
- 2025-08-02 - CVE-2025-8152 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8152
Vulnerability Analysis
The vulnerability is a Missing Authorization flaw [CWE-862] in the WP CTA WordPress plugin. Two AJAX-style handler functions, update_cta_status and change_sticky_sidebar_name, are registered without validating that the caller has the required WordPress capability. The plugin exposes these actions to unauthenticated visitors rather than restricting them to administrators. As a result, any remote client can invoke the handlers and alter plugin state stored in the WordPress database. The impact is limited to data integrity affecting plugin configuration values, with no direct confidentiality or availability impact according to the CVSS vector.
Root Cause
The root cause is the absence of a current_user_can() capability check and a nonce verification step inside the update_cta_status and change_sticky_sidebar_name functions defined in inc/ClassActions.php. WordPress plugins that register admin actions must gate privileged operations behind both a capability check and a nonce. Because both controls are missing, the endpoints treat any request — including those from unauthenticated users — as authorized. The upstream code review references at lines 29 and 52 of ClassActions.php illustrate where the checks should be enforced.
Attack Vector
An attacker sends a crafted HTTP request to the WordPress site's admin-ajax.php endpoint, invoking the vulnerable plugin actions with attacker-controlled parameters. No authentication cookies, credentials, or user interaction are required. Successful requests toggle the sticky CTA status or overwrite the sidebar display name shown in the WP CTA Dashboard. Attackers can automate this against exposed WordPress sites at scale. See the Wordfence Vulnerability Report and the WordPress Plugin Code Review for technical details.
Detection Methods for CVE-2025-8152
Indicators of Compromise
- Unexpected changes to sticky CTA status values or sidebar display names in the WP CTA Dashboard.
- Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing the update_cta_status or change_sticky_sidebar_name actions.
- Database modifications to plugin option rows associated with easy-sticky-sidebar originating from anonymous sessions.
Detection Strategies
- Review web server access logs for POST requests to admin-ajax.php where the action parameter matches the vulnerable function names and no valid authentication cookie is present.
- Enable WordPress audit logging to record plugin option changes and correlate them with request source IPs.
- Deploy a Web Application Firewall (WAF) rule to flag unauthenticated invocations of the affected AJAX actions.
Monitoring Recommendations
- Monitor for anomalous request volume against admin-ajax.php from single source IPs targeting WordPress installations.
- Track modifications to plugin-managed wp_options rows and alert on out-of-band changes.
- Include the plugin slug easy-sticky-sidebar in vulnerability scanning inventories to identify vulnerable instances across managed sites.
How to Mitigate CVE-2025-8152
Immediate Actions Required
- Update the WP CTA – Call To Action plugin to a version later than 1.7.0 that includes the fix referenced in the WordPress Changeset Overview.
- Audit the WP CTA Dashboard configuration for unauthorized changes to sticky status and sidebar names.
- Restrict access to /wp-admin/admin-ajax.php for unauthenticated users at the WAF or reverse proxy layer where feasible.
Patch Information
The plugin author released a fix tracked in the WordPress plugin repository under changeset 3336867 for easy-sticky-sidebar. The patch introduces the missing capability and nonce checks on the affected handler functions. Administrators should install the latest available plugin release through the WordPress admin dashboard or via wp-cli. Confirm the installed version is greater than 1.7.0 after applying the update.
Workarounds
- Deactivate and remove the WP CTA plugin until the patched version can be installed.
- Add a WAF rule that blocks unauthenticated requests to admin-ajax.php where the action parameter equals update_cta_status or change_sticky_sidebar_name.
- Limit outbound exposure of the WordPress admin surface by IP allowlisting where operationally acceptable.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
